| openstackgerrit | Steve Martinelli proposed openstack/keystoneauth: Document named kerberos plugin https://review.openstack.org/329148 | 00:04 |
|---|---|---|
| *** nkinder has quit IRC | 00:05 | |
| *** roxanaghe has quit IRC | 00:05 | |
| *** anteaya has joined #openstack-keystone | 00:11 | |
| *** ddieterly has joined #openstack-keystone | 00:14 | |
| *** aratus has quit IRC | 00:19 | |
| *** tqtran has quit IRC | 00:21 | |
| *** gyee has quit IRC | 00:21 | |
| *** adrian_otto has quit IRC | 00:26 | |
| *** opilotte- has quit IRC | 00:28 | |
| *** ktychkova has quit IRC | 00:29 | |
| *** ktychkova has joined #openstack-keystone | 00:30 | |
| *** opilotte- has joined #openstack-keystone | 00:31 | |
| *** browne has quit IRC | 00:41 | |
| *** raddaoui has quit IRC | 00:47 | |
| jamielennox | samueldmq, notmorgan: there is some seperation between opts | 00:56 |
| jamielennox | one function is in setup.cfg for oslo.config opts | 00:56 |
| jamielennox | and they don't include the deprecated opts | 00:56 |
| jamielennox | so there is no username opt in there | 00:56 |
| jamielennox | for example | 00:57 |
| jamielennox | otherwise i think we had opts for dependency reasons | 00:57 |
| jamielennox | samueldmq: the main change i would make is i don't think we want those new symbols to be public | 00:58 |
| jamielennox | samueldmq: i have various changes up, i can't remember if i move those opts or not, but if they're public we need to maintain it if we ever do move it and i would like as little about auth_token to be public as possible | 00:58 |
| *** adrian_otto has joined #openstack-keystone | 01:05 | |
| *** edtubill has joined #openstack-keystone | 01:12 | |
| ayoung | jamielennox, I chatted a bit with notmorgan today, and we both agreed that I should just rewrite the scopetoken SAML auth plugin IAW the federated on I posted on my blog. You cool with that? | 01:14 |
| *** adrian_otto has quit IRC | 01:15 | |
| jamielennox | ayoung: for ksc or ksa? | 01:15 |
| ayoung | jamielennox, both | 01:15 |
| ayoung | ksa will be for the future | 01:15 |
| jamielennox | ayoung: because i think it should be already done that way for ksa | 01:15 |
| ayoung | ksc for a bug fix for OSP | 01:15 |
| ayoung | is it...let me check | 01:15 |
| jamielennox | ayoung: see https://github.com/openstack/keystoneauth/blob/master/keystoneauth1/extras/_saml2/v3/base.py#L27 | 01:16 |
| jamielennox | BaseSamlPlugin depends on federationbaseauth | 01:16 |
| jamielennox | i think that should cover it | 01:16 |
| ayoung | look right | 01:17 |
| jamielennox | see https://github.com/openstack/keystoneauth/blob/master/keystoneauth1/identity/v3/federation.py | 01:17 |
| jamielennox | so if you present scoping data it will auto rescope as it should | 01:17 |
| ayoung | I wonder how these are going to work with ECP if some other authentication mechanism is used other than password | 01:17 |
| jamielennox | yea, so i argued tat out with someone | 01:18 |
| jamielennox | can't remember who | 01:18 |
| jamielennox | i think there is no choice regarding loading but to write a new plugin for each mechanism | 01:18 |
| jamielennox | but if you look at: | 01:18 |
| jamielennox | https://review.openstack.org/#/c/255056/ | 01:18 |
| patchbot | jamielennox: patch 255056 - keystoneauth - Use SAML2 requests plugin | 01:18 |
| ayoung | Probably, but I bet we can reuse 98% of the code and make a Password, Kerberos, and X509SAML plugin. Besurprised if we needed more thna that | 01:19 |
| jamielennox | the way i wrote that saml/ecp plugin is that it takes a requests plugin (like basic auth or kerberos or x509) as a param then handled the ECP bit on top | 01:19 |
| ayoung | jamielennox, is the size of the diff on the first file mostly due to formatting? | 01:20 |
| ayoung | https://review.openstack.org/#/c/255056/5/keystoneauth1/extras/_saml2/v3/saml2.py | 01:20 |
| patchbot | ayoung: patch 255056 - keystoneauth - Use SAML2 requests plugin | 01:20 |
| jamielennox | ayoung: no, it's a rearrange | 01:20 |
| jamielennox | ayoung: i extracted the SAML parts and made it a requests auth plugin instead of a keystoneauth plugin | 01:20 |
| jamielennox | my idea is if we can prove this out i can make the requests plugin part of the requests extensions rather than maintain it for ksa | 01:21 |
| ayoung | should that move to upstream requests eventually? | 01:21 |
| ayoung | I like that | 01:21 |
| jamielennox | so it's all the same code and work but it's a different mechanism | 01:21 |
| jamielennox | but basically i want to test it better and i haven't had an IPA setup for a while | 01:22 |
| stevemar | jamielennox: so a requests extension would handle all the ECP exchange? | 01:22 |
| jamielennox | stevemar: yes, same way we use requests-kerberos for all the kerberos stuff | 01:22 |
| stevemar | jamielennox: ah | 01:22 |
| stevemar | splendid | 01:22 |
| ayoung | jamielennox, do you need one? I have ipa.younglogic.net still running | 01:23 |
| jamielennox | then the idea would be we have a number of plugins like kerberos and SAML that do exactly the same thing but take a different requests plugin | 01:23 |
| ayoung | jamielennox, and there is an ipsilon instance at https://ipa.younglogic.net/idp | 01:23 |
| jamielennox | so we super generalize ksa plugins to some code that basically wraps calling a requests plugin | 01:23 |
| *** edtubill has quit IRC | 01:24 | |
| jamielennox | ayoung: yea, can i have an account on that? | 01:24 |
| jamielennox | ayoung: do you have a keystone attached to it? | 01:24 |
| jamielennox | really i want to test the SAML auth part, if that works i'm sure the keystone part works fine | 01:25 |
| jamielennox | so it doesn't matter if not | 01:25 |
| openstackgerrit | Maho Koshiya proposed openstack/python-keystoneclient: Add return-request-id-to-caller function(v2_0) https://review.openstack.org/267449 | 01:25 |
| jamielennox | oh, i've had that open to review for a while now ^ | 01:25 |
| *** ddieterly is now known as ddieterly[away] | 01:28 | |
| *** pushkaru has quit IRC | 01:31 | |
| *** pushkaru has joined #openstack-keystone | 01:32 | |
| *** edtubill has joined #openstack-keystone | 01:33 | |
| *** ddieterly[away] has quit IRC | 01:33 | |
| *** EinstCrazy has joined #openstack-keystone | 01:33 | |
| *** pushkaru has quit IRC | 01:40 | |
| *** edtubill has quit IRC | 01:40 | |
| *** ddieterly has joined #openstack-keystone | 01:49 | |
| ayoung | jamielennox, no keystone attached to it right now | 01:49 |
| ayoung | easy enough to set up. | 01:50 |
| jamielennox | ayoung: that's ok, i guess i just need to authenticate against something that does a proper saml redirect | 01:50 |
| *** EinstCra_ has joined #openstack-keystone | 01:51 | |
| ayoung | jamielennox, heh...coulse, I might have just had to change all the passwords and then forgotten them... | 01:52 |
| *** EinstCrazy has quit IRC | 01:55 | |
| jamielennox | hey, was there a consensus on good midcycle hotels? | 01:55 |
| jamielennox | i see the google maps thing on the wiki | 01:56 |
| jamielennox | but none of that tells me if i can get away with not having a car, or if anyone else is nearby | 01:56 |
| ayoung | talk to topol, he had one set forthe IBMers | 01:57 |
| *** EinstCra_ has quit IRC | 01:58 | |
| *** ddieterly has quit IRC | 01:59 | |
| *** EinstCrazy has joined #openstack-keystone | 01:59 | |
| *** EinstCrazy has quit IRC | 02:01 | |
| *** EinstCrazy has joined #openstack-keystone | 02:03 | |
| stevemar | ayoung: maybe topol is online ;O | 02:07 |
| ayoung | stevemar, how's the wee one? | 02:07 |
| ayoung | Pun totally intended | 02:07 |
| stevemar | ayoung: was great until yesterday, he was frantic for about 2 hours | 02:07 |
| stevemar | turns out is was really really bad gas | 02:08 |
| stevemar | he's better today | 02:08 |
| stevemar | i should be able to be online for most of the day time tomorrow, trying to ease back into things this week | 02:08 |
| ayoung | You know the "put him in the car seat and swing it" approach to calming him down? | 02:09 |
| openstackgerrit | Merged openstack/keystoneauth: Document named kerberos plugin https://review.openstack.org/329148 | 02:09 |
| *** mfisch has quit IRC | 02:10 | |
| stevemar | ayoung: yep, i've done that, and the actual swing, which seems to work well for gas | 02:16 |
| ayoung | stevemar, that is pretty much the limit of my parenting skills. | 02:16 |
| stevemar | ayoung: we weren't burping him properly before, i think i've got the hang of it now, heard a few belches | 02:17 |
| stevemar | ayoung: i'm sure it's more than that :P | 02:17 |
| ayoung | stevemar, you going to the midcycle? | 02:17 |
| stevemar | ayoung: yep, looking at hotels now | 02:18 |
| stevemar | ayoung: only cause jamielennox reminded me about it :P | 02:18 |
| ayoung | let me know which you two pick and I'll dogpile on | 02:18 |
| jamielennox | i've got no idea how to get around there and i'm trying to not be a long way from everyone | 02:18 |
| jamielennox | and ideally not have a car | 02:18 |
| jamielennox | so i'm trusting everyone else | 02:19 |
| stevemar | jamielennox: brad almost always rents a car, i can too | 02:19 |
| stevemar | jamielennox: brad told me the hotel he booked at, let me see if i can find it in our transcripts | 02:19 |
| *** EinstCrazy has quit IRC | 02:20 | |
| stevemar | jamielennox: he's at: Holiday Inn SAN JOSE - SILICON VALLEY 1350 North 1st Street,San Jose, CA 95112 | 02:21 |
| stevemar | by the airport, dirt | 02:22 |
| stevemar | 4 miles away from cisco though | 02:22 |
| stevemar | jamielennox: there's a hilton and a hyatt on tasman drive, i wonder why those aren't coming up in policy | 02:23 |
| jamielennox | stevemar: so i'm pretty sure that didn't even come up on the map for me | 02:24 |
| stevemar | jamielennox: searching now | 02:25 |
| dstanek | i need to book a hotel soon too. i'd like to get one in walking distance | 02:26 |
| EmilienM | samueldmq: thanks again | 02:28 |
| EmilienM | you rocks | 02:28 |
| *** EinstCrazy has joined #openstack-keystone | 02:29 | |
| *** julim has joined #openstack-keystone | 02:29 | |
| stevemar | jamielennox: yeah, that one isn't showing up for me either | 02:30 |
| stevemar | jamielennox: closest one is about 6 km away | 02:30 |
| ayoung | They have bike Share in Southbay yet? | 02:31 |
| *** dave-mccowan has quit IRC | 02:32 | |
| jamielennox | so advantage of being near the airport is there is a tram line that looks to go from there to right outside cisco approx every 10 min | 02:35 |
| *** nkinder has joined #openstack-keystone | 02:40 | |
| *** ddieterly has joined #openstack-keystone | 02:44 | |
| *** EinstCrazy has quit IRC | 02:45 | |
| *** EinstCrazy has joined #openstack-keystone | 02:45 | |
| *** ddieterly has quit IRC | 02:46 | |
| *** woodster_ has quit IRC | 02:48 | |
| stevemar | ayoung: someone one the ops mailing list said federation is wonderful! wonderful! | 02:55 |
| ayoung | stevemar, meh | 02:55 |
| stevemar | *lowered expectaaaaations* | 02:55 |
| stevemar | https://www.youtube.com/watch?v=3flv5nWZgII | 02:56 |
| *** edtubill has joined #openstack-keystone | 02:56 | |
| *** richm has quit IRC | 02:59 | |
| *** edtubill has quit IRC | 03:01 | |
| *** EinstCrazy has quit IRC | 03:01 | |
| *** EinstCrazy has joined #openstack-keystone | 03:04 | |
| stevemar | jamielennox: samueldmq does ksm need a new release? https://review.openstack.org/#/c/329091/ just merged | 03:06 |
| patchbot | stevemar: patch 329091 - keystonemiddleware - Move auth token opts calculation into auth_token (MERGED) | 03:06 |
| stevemar | nvm, i see https://review.openstack.org/#/c/319715/ introduced it, so someone was using master | 03:07 |
| patchbot | stevemar: patch 319715 - keystonemiddleware - Create a Config object (MERGED) | 03:07 |
| *** links has joined #openstack-keystone | 03:08 | |
| stevemar | jamielennox: also https://review.openstack.org/#/c/276350/ just merged, we will finally be able to use KSA plugins from OSC | 03:09 |
| patchbot | stevemar: patch 276350 - python-openstackclient - Moving authentication from keystoneclient to keyst... (MERGED) | 03:09 |
| stevemar | that's kind of huge for federation :D | 03:09 |
| stevemar | just need a new release of osc first | 03:10 |
| *** openstackgerrit has quit IRC | 03:11 | |
| *** openstackgerrit has joined #openstack-keystone | 03:11 | |
| *** afred312 has quit IRC | 03:26 | |
| *** iurygregory_ has quit IRC | 03:33 | |
| openstackgerrit | Maho Koshiya proposed openstack/python-keystoneclient: Add return-request-id-to-caller function(v3) https://review.openstack.org/267456 | 03:38 |
| openstackgerrit | Maho Koshiya proposed openstack/python-keystoneclient: Add return-request-id-to-caller function(v3/contrib) https://review.openstack.org/268003 | 03:44 |
| *** ayoung has quit IRC | 03:56 | |
| *** edtubill has joined #openstack-keystone | 03:59 | |
| openstackgerrit | Merged openstack/keystone: Add 'links' to implied roles response https://review.openstack.org/300195 | 04:04 |
| *** edtubill has quit IRC | 04:15 | |
| *** markvoelker has quit IRC | 04:16 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Use /v3/auth/projects and /v3/auth/domains https://review.openstack.org/329193 | 04:27 |
| *** afred312 has joined #openstack-keystone | 04:27 | |
| *** afred312 has quit IRC | 04:33 | |
| *** pcaruana has quit IRC | 04:39 | |
| *** edtubill has joined #openstack-keystone | 04:57 | |
| *** sheel has joined #openstack-keystone | 05:04 | |
| *** jaosorior has joined #openstack-keystone | 05:11 | |
| *** markvoelker has joined #openstack-keystone | 05:17 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/329268 | 05:20 |
| *** markvoelker has quit IRC | 05:22 | |
| *** wangqun has joined #openstack-keystone | 05:24 | |
| *** GB21 has joined #openstack-keystone | 05:39 | |
| *** EinstCrazy has quit IRC | 05:40 | |
| wangqun | Hi all | 05:45 |
| wangqun | Does the feature of the keystone federation with openID need mannually to set up? | 05:45 |
| wangqun | Does it have the feature if I install keystone by devstack in kilo version ? | 05:45 |
| wangqun | Can any one answer to me ? | 05:48 |
| *** GB21 has quit IRC | 05:53 | |
| *** GB21 has joined #openstack-keystone | 05:53 | |
| *** roxanaghe has joined #openstack-keystone | 06:00 | |
| *** roxanaghe has quit IRC | 06:00 | |
| *** edtubill has quit IRC | 06:08 | |
| wangqun | ping notmorgan | 06:10 |
| wangqun | Are you here? | 06:11 |
| *** rcernin has joined #openstack-keystone | 06:11 | |
| *** edtubill has joined #openstack-keystone | 06:12 | |
| *** GB21 has quit IRC | 06:15 | |
| *** pcaruana has joined #openstack-keystone | 06:16 | |
| openstackgerrit | Maho Koshiya proposed openstack/python-keystoneclient: Add wrapper classes for return-request-id-to-caller https://review.openstack.org/261188 | 06:18 |
| *** edtubill has quit IRC | 06:24 | |
| *** henrynash_ has joined #openstack-keystone | 06:30 | |
| *** ChanServ sets mode: +v henrynash_ | 06:30 | |
| *** GB21 has joined #openstack-keystone | 06:31 | |
| *** EinstCrazy has joined #openstack-keystone | 06:32 | |
| *** EinstCrazy has quit IRC | 06:39 | |
| *** EinstCrazy has joined #openstack-keystone | 06:41 | |
| notmorgan | wangqun: unfortunately it is almost mignight here and i need to sleep :(. All of the federation work from keystone requires more than "automatic" setup. http://docs.openstack.org/developer/keystone/extensions/openidc.html https://developer.ibm.com/opentech/2015/06/17/use-websphere-liberty-as-an-openid-connect-provider-for-openstack/ | 06:43 |
| notmorgan | wangqun: i'd offer to help a bit more if i wasn't about to pass out. | 06:43 |
| notmorgan | wangqun: hopefully that can get you started | 06:43 |
| *** EinstCrazy has quit IRC | 06:44 | |
| *** EinstCrazy has joined #openstack-keystone | 06:44 | |
| wangqun | Hi notmorgan, Thank you to answer my question. I will learn it. :) | 06:45 |
| *** openstackgerrit has quit IRC | 06:48 | |
| *** openstackgerrit has joined #openstack-keystone | 06:48 | |
| openstackgerrit | Maho Koshiya proposed openstack/python-keystoneclient: Add wrapper classes for return-request-id-to-caller https://review.openstack.org/261188 | 06:49 |
| *** tesseract has joined #openstack-keystone | 06:56 | |
| *** amoralej|off is now known as amoralej | 06:58 | |
| *** EinstCrazy has quit IRC | 06:59 | |
| *** EinstCrazy has joined #openstack-keystone | 07:00 | |
| *** markvoelker has joined #openstack-keystone | 07:18 | |
| openstackgerrit | Merged openstack/keystone: Updated from global requirements https://review.openstack.org/329268 | 07:18 |
| *** pece has joined #openstack-keystone | 07:21 | |
| *** markvoelker has quit IRC | 07:22 | |
| *** dmk0202 has joined #openstack-keystone | 07:32 | |
| *** pece has quit IRC | 07:32 | |
| *** jaosorior is now known as jaosorior_brb | 07:35 | |
| *** EinstCrazy has quit IRC | 07:37 | |
| *** EinstCrazy has joined #openstack-keystone | 07:40 | |
| *** EinstCrazy has quit IRC | 07:45 | |
| *** EinstCrazy has joined #openstack-keystone | 07:45 | |
| *** GB21 has quit IRC | 07:47 | |
| *** EinstCrazy has quit IRC | 07:49 | |
| *** EinstCrazy has joined #openstack-keystone | 07:50 | |
| *** EinstCrazy has quit IRC | 07:55 | |
| *** zzzeek has quit IRC | 08:00 | |
| *** zzzeek has joined #openstack-keystone | 08:00 | |
| *** EinstCrazy has joined #openstack-keystone | 08:01 | |
| *** pnavarro has joined #openstack-keystone | 08:08 | |
| *** danpawlik has joined #openstack-keystone | 08:09 | |
| openstackgerrit | Davanum Srinivas (dims) proposed openstack/keystone: [WIP] Testing latest u-c https://review.openstack.org/318435 | 08:10 |
| openstackgerrit | Davanum Srinivas (dims) proposed openstack/keystone: [WIP] Testing latest u-c https://review.openstack.org/318435 | 08:10 |
| *** lhinds_ has joined #openstack-keystone | 08:12 | |
| *** GB21 has joined #openstack-keystone | 08:18 | |
| *** mvk has quit IRC | 08:24 | |
| *** shewless has quit IRC | 08:25 | |
| *** pece has joined #openstack-keystone | 08:28 | |
| *** afred312 has joined #openstack-keystone | 08:29 | |
| *** henrynash_ has quit IRC | 08:29 | |
| *** afred312 has quit IRC | 08:34 | |
| *** jaosorior_brb has quit IRC | 08:39 | |
| *** jaosorior_brb has joined #openstack-keystone | 08:40 | |
| *** srushti has left #openstack-keystone | 08:45 | |
| *** mvk has joined #openstack-keystone | 08:51 | |
| *** EinstCrazy has quit IRC | 08:52 | |
| *** jaosorior_brb is now known as jaosorior | 08:53 | |
| *** EinstCrazy has joined #openstack-keystone | 08:54 | |
| *** vgridnev has quit IRC | 09:03 | |
| *** EinstCrazy has quit IRC | 09:10 | |
| *** EinstCrazy has joined #openstack-keystone | 09:10 | |
| *** EinstCrazy has quit IRC | 09:18 | |
| *** EinstCrazy has joined #openstack-keystone | 09:18 | |
| *** GB21 has quit IRC | 09:25 | |
| *** nisha_ has joined #openstack-keystone | 09:32 | |
| *** EinstCrazy has quit IRC | 09:33 | |
| *** EinstCrazy has joined #openstack-keystone | 09:33 | |
| *** EinstCrazy has quit IRC | 09:41 | |
| *** EinstCrazy has joined #openstack-keystone | 09:41 | |
| *** EinstCrazy has quit IRC | 09:45 | |
| *** EinstCrazy has joined #openstack-keystone | 09:46 | |
| *** nisha_ has quit IRC | 09:47 | |
| *** mvk has quit IRC | 09:50 | |
| *** mvk has joined #openstack-keystone | 09:51 | |
| *** henrynash_ has joined #openstack-keystone | 09:52 | |
| *** ChanServ sets mode: +v henrynash_ | 09:52 | |
| *** GB21 has joined #openstack-keystone | 09:52 | |
| *** EinstCrazy has quit IRC | 09:53 | |
| *** EinstCrazy has joined #openstack-keystone | 09:53 | |
| *** dulek has joined #openstack-keystone | 09:59 | |
| dulek | Hi. Is it possible to access and edit extras column in projects table to store some additional information related to a project? | 09:59 |
| *** EinstCrazy has quit IRC | 10:03 | |
| *** EinstCrazy has joined #openstack-keystone | 10:03 | |
| *** nisha_ has joined #openstack-keystone | 10:04 | |
| samueldmq | morning keystone | 10:06 |
| *** links has quit IRC | 10:07 | |
| samueldmq | dulek: hi. any attributes passed to a create/update project call that are not defined by keystone will end up in the 'extras' column | 10:08 |
| samueldmq | dulek: which is a blob | 10:08 |
| *** dmk0202 has quit IRC | 10:08 | |
| *** wangqun has quit IRC | 10:14 | |
| *** rk4n has joined #openstack-keystone | 10:20 | |
| *** links has joined #openstack-keystone | 10:20 | |
| *** nisha__ has joined #openstack-keystone | 10:21 | |
| *** nisha_ has quit IRC | 10:25 | |
| *** EinstCrazy has quit IRC | 10:25 | |
| samueldmq | stevemar: hi. you're right, that broke some gates (master code) | 10:29 |
| *** afred312 has joined #openstack-keystone | 10:31 | |
| *** EinstCrazy has joined #openstack-keystone | 10:32 | |
| *** afred312 has quit IRC | 10:35 | |
| *** EinstCrazy has quit IRC | 10:36 | |
| *** nisha__ is now known as nisha_ | 10:42 | |
| nisha_ | hey samueldmq | 10:42 |
| samueldmq | nisha_: hi, morning | 10:43 |
| *** EinstCrazy has joined #openstack-keystone | 10:45 | |
| *** rmizuno has joined #openstack-keystone | 10:49 | |
| nisha_ | samueldmq, I had a small doubt, https://github.com/openstack-attic/identity-api/blob/master/v3/src/markdown/identity-api-v3.md#list-domains-get-domains | 10:55 |
| nisha_ | When I list the domains, without passing anything, it returns all the domains | 10:55 |
| nisha_ | samueldmq, the doc says there are 2 Optional query parameters, but I don't see any difference in the output when I use them in the GET method | 10:56 |
| *** nisha__ has joined #openstack-keystone | 10:58 | |
| *** nisha_ has quit IRC | 11:02 | |
| *** permalac has quit IRC | 11:09 | |
| samueldmq | nisha__: those are filters... you may use them like : GET /v3/domains?enabled=true | 11:11 |
| samueldmq | nisha__: thus only enabled domains will be returned | 11:11 |
| samueldmq | nisha__: same applies to name filtering | 11:11 |
| *** sheel has quit IRC | 11:15 | |
| samueldmq | jamielennox: hi, there are a couple of changes in keystoneclient for returning x-openstack-request-id in the responses | 11:17 |
| samueldmq | jamielennox: it'd be super valuable to get your feedback on them https://review.openstack.org/#/q/status:open+project:openstack/python-keystoneclient+branch:master+topic:bp/return-request-id-to-caller | 11:17 |
| *** EinstCrazy has quit IRC | 11:22 | |
| *** rk4n has quit IRC | 11:25 | |
| *** gordc has joined #openstack-keystone | 11:30 | |
| *** rodrigods has quit IRC | 11:35 | |
| *** rodrigods has joined #openstack-keystone | 11:35 | |
| danpawlik | Hello, I want to ask about keystonemiddleware and its configuration file. I want to add misssing parameters into keystone_authtoken section, but I don't know which parameters are deprecated which not. So if you have some time, pls check https://review.openstack.org/#/c/328620/1/manifests/resource/authtoken.pp and comment me which are and which not ;) | 11:38 |
| patchbot | danpawlik: patch 328620 - puppet-keystone - Add misssing parameters to keystone_authtoken | 11:38 |
| *** jed56 has quit IRC | 11:45 | |
| *** rk4n has joined #openstack-keystone | 11:46 | |
| samueldmq | danpawlik: hi, I added myself as a reviewer to your change | 11:46 |
| samueldmq | danpawlik: I will look at it later today | 11:46 |
| *** ddieterly has joined #openstack-keystone | 11:49 | |
| *** ashokt has joined #openstack-keystone | 11:51 | |
| ashokt | HI all, can anyone help me on this issue, while installing devstack on centos.. I faced the issue like | 11:53 |
| ashokt | usage: keystone-manage [db_sync|db_version|domain_config_upload|fernet_rotate|fernet_setup|mapping_purge|mapping_engine|pki_setup|saml_idp_metadata|ssl_setup|token_flush] keystone-manage: error: argument command: invalid choice: 'bootstrap' (choose from 'db_sync', 'db_version', 'domain_config_upload', 'fernet_rotate', 'fernet_setup', 'mapping_purge', 'mapping_engine', 'pki_setup', 'saml_idp_metadata', 'ssl_setup', 'token_ | 11:53 |
| ashokt | help me how to resolve this? | 11:53 |
| *** raildo-afk is now known as raildo | 11:54 | |
| *** jed56 has joined #openstack-keystone | 12:02 | |
| *** daemontool has joined #openstack-keystone | 12:11 | |
| *** markvoelker has joined #openstack-keystone | 12:13 | |
| EmilienM | samueldmq: hey! | 12:14 |
| EmilienM | I think I still see the issue in Sahara :( | 12:14 |
| EmilienM | http://logs.openstack.org/91/328591/9/check/gate-puppet-openstack-integration-3-scenario003-tempest-centos-7/46dc9ee/logs/syslog.txt.gz#_Jun_14_10_42_44 | 12:14 |
| EmilienM | samueldmq: I'll try again to make sure I have latest keystonemiddleware | 12:15 |
| *** ddieterly has quit IRC | 12:16 | |
| *** pauloewerton has joined #openstack-keystone | 12:16 | |
| *** nisha__ is now known as nisha_ | 12:17 | |
| danpawlik | samueldmq: ok, thanks | 12:25 |
| *** lamt has joined #openstack-keystone | 12:30 | |
| *** afred312 has joined #openstack-keystone | 12:32 | |
| *** afred312 has quit IRC | 12:37 | |
| *** ddieterly has joined #openstack-keystone | 12:37 | |
| *** ddieterly is now known as ddieterly[away] | 12:46 | |
| *** amoralej is now known as amoralej|lunch | 12:48 | |
| *** GB21 has quit IRC | 12:51 | |
| *** nisha_ has quit IRC | 12:56 | |
| *** amakarov_away is now known as amakarov | 13:06 | |
| *** afred312 has joined #openstack-keystone | 13:14 | |
| *** dave-mccowan has joined #openstack-keystone | 13:20 | |
| *** ddieterly has joined #openstack-keystone | 13:28 | |
| *** ericksonsantos has joined #openstack-keystone | 13:29 | |
| *** woodster_ has joined #openstack-keystone | 13:33 | |
| *** lhinds_ has quit IRC | 13:34 | |
| *** richm has joined #openstack-keystone | 13:36 | |
| *** amoralej|lunch is now known as amoralej | 13:37 | |
| *** edtubill has joined #openstack-keystone | 13:38 | |
| *** edmondsw has joined #openstack-keystone | 13:41 | |
| *** edtubill has quit IRC | 13:41 | |
| *** darosale has joined #openstack-keystone | 13:44 | |
| *** fifieldt has joined #openstack-keystone | 13:47 | |
| *** ddieterly is now known as ddieterly[away] | 13:47 | |
| *** EinstCrazy has joined #openstack-keystone | 13:50 | |
| *** nisha_ has joined #openstack-keystone | 13:55 | |
| *** ddieterly[away] is now known as ddieterly | 13:58 | |
| *** rderose has joined #openstack-keystone | 13:58 | |
| *** vnogin has joined #openstack-keystone | 14:01 | |
| *** jaosorior has quit IRC | 14:05 | |
| *** edtubill has joined #openstack-keystone | 14:10 | |
| *** lucas___ has joined #openstack-keystone | 14:10 | |
| knikolla | o/ | 14:11 |
| *** links has quit IRC | 14:14 | |
| dstanek | rodrigods: did you have a case for keeping driver versioning? | 14:15 |
| rodrigods | dstanek, not at all | 14:15 |
| rodrigods | i'm +1 for dropping it - with proper operators feedback, of course | 14:15 |
| *** henrynash_ has quit IRC | 14:16 | |
| rodrigods | knikolla, ping... regarding tests setup in federation | 14:20 |
| knikolla | rodrigods: hi | 14:20 |
| dstanek | rodrigods: is sounded like you comment was hinting at a usecase related to hierarchical project naming | 14:21 |
| *** EinstCrazy has quit IRC | 14:21 | |
| dstanek | s/is/it/ | 14:21 |
| rodrigods | dstanek, raildo? | 14:21 |
| rodrigods | knikolla, i'm inclined in doing the setup in the tests itself: create idp, mapping, sp, protocol | 14:22 |
| rodrigods | using some configs | 14:22 |
| raildo | it was me | 14:22 |
| knikolla | rodrigods: including apache config? | 14:22 |
| rodrigods | knikolla, no... this can't be controlled by us | 14:22 |
| rodrigods | i mean the keystone stuff | 14:23 |
| knikolla | rodrigods: the devstack plugin can do that, waiting on breton to test it with generic federation and submit a patchset | 14:23 |
| rodrigods | knikolla, i know, but if we want to test in different envs | 14:24 |
| rodrigods | and also modify a bit the scenarios | 14:24 |
| raildo | dstanek: I think that the better person to make this question is henrynash, since he was the guy who implemented it. | 14:24 |
| rodrigods | would be much harder by having to manually setup stuff in these different envs or having to modify the plugin to include a twist in the scenario | 14:24 |
| raildo | like on this patch https://review.openstack.org/#/c/305315/ | 14:24 |
| patchbot | raildo: patch 305315 - keystone - Create V9 driver for identity backend | 14:24 |
| knikolla | rodrigods: sure, that would work. | 14:25 |
| knikolla | rodrigods: this is what we have till now on the k2k test, https://github.com/rodrigods/keystone/compare/liberty/tempest_plugin...wjdan94:liberty/tempest_plugin | 14:26 |
| rodrigods | knikolla, cool! | 14:27 |
| *** ayoung has joined #openstack-keystone | 14:36 | |
| *** ChanServ sets mode: +v ayoung | 14:36 | |
| *** jrist has quit IRC | 14:38 | |
| dstanek | raildo: i thought that project naming stuff hasn't been implemented yet | 14:40 |
| *** BjoernT has joined #openstack-keystone | 14:40 | |
| dstanek | rodrigods: right tab-completion fail | 14:40 |
| raildo | dstanek: and it isn't merged, as henrynash says on the commit message "" | 14:41 |
| raildo | Upcoming changes will add new methods to the identity drivers, so | 14:41 |
| raildo | in preparation for that we create a new versioned driver. | 14:41 |
| raildo | ops, sorry, copy and paste.. | 14:41 |
| dstanek | raildo: this is one of those cases i argued at the begining of the versioned driver impl. the adapter approach will break down with anything sufficiently complicated being added to the driver | 14:43 |
| samueldmq | EmilienM: hi. yes, please check you have the latest middleware code | 14:43 |
| samueldmq | EmilienM: it should be running fine at this point | 14:44 |
| EmilienM | samueldmq: ack nevermind my comment earlier | 14:45 |
| raildo | dstanek: I totally agree with the idea to don't use driver versioning, I'm just concern that we probably have some issues to implement on this way, we just need to be clear, how we will handle with this issues, if we decide to don't follow this approach... | 14:45 |
| samueldmq | EmilienM: :) | 14:45 |
| raildo | dstanek: for example fix this bug: https://launchpad.net/bugs/1523369 | 14:45 |
| openstack | Launchpad bug 1523369 in OpenStack Identity (keystone) "clean a user's default project if the project has been deleted" [Wishlist,In progress] - Assigned to Kalaswan Datta (kalaswan-datta) | 14:45 |
| *** timcline has joined #openstack-keystone | 14:47 | |
| *** julim has quit IRC | 14:47 | |
| *** timcline has quit IRC | 14:48 | |
| *** timcline has joined #openstack-keystone | 14:49 | |
| *** jrist has joined #openstack-keystone | 14:50 | |
| raildo | dstanek: maybe put this as a topic on the today's meeting? | 14:52 |
| dolphm | rderose: https://www.postgresql.org/docs/current/static/functions-datetime.html#FUNCTIONS-DATETIME-CURRENT | 14:57 |
| dolphm | rderose: plus http://docs.sqlalchemy.org/en/latest/core/defaults.html#server-side-defaults | 14:57 |
| rderose | dolphm: thanks | 15:00 |
| *** phalmos has joined #openstack-keystone | 15:00 | |
| dstanek | raildo: are we still talking about the driver versioning? | 15:01 |
| samueldmq | dstanek: there's a topic in today's meeting about it :D | 15:04 |
| *** gagehugo has joined #openstack-keystone | 15:04 | |
| dstanek | samueldmq: yep | 15:05 |
| *** fifieldt has quit IRC | 15:08 | |
| *** frontrunner has joined #openstack-keystone | 15:09 | |
| samueldmq | dstanek: I don't know what your view on that is, but I fully support it if we have enough feedback from operators | 15:09 |
| *** aratus has joined #openstack-keystone | 15:09 | |
| samueldmq | dstanek: to let us decide that it's not worth it to keep supporting it | 15:09 |
| *** rcernin has quit IRC | 15:11 | |
| *** julim has joined #openstack-keystone | 15:14 | |
| *** pece has quit IRC | 15:15 | |
| *** phalmos has quit IRC | 15:17 | |
| *** rmizuno_ has joined #openstack-keystone | 15:20 | |
| *** rderose has quit IRC | 15:22 | |
| *** jaugustine has joined #openstack-keystone | 15:22 | |
| *** jaugustine has quit IRC | 15:23 | |
| notmorgan | henrynash: i'm sorry i'm going to be a hard -2 on relaxing the uniqueness constraing and dropping v3.6 for a very very very (read 4+ cycles) long time | 15:23 |
| *** rderose has joined #openstack-keystone | 15:24 | |
| notmorgan | henrynash: breaking compatibility of clients is not ok like that. microversions provide us provisions for moving forward, but you can't break the old versions, and dropping the old versions becomes just as bad in most cases as breaking the contract. | 15:25 |
| *** henrynash_ has joined #openstack-keystone | 15:26 | |
| *** ChanServ sets mode: +v henrynash_ | 15:26 | |
| henrynash | notmorgan: no issues with you being tough on this at all | 15:30 |
| notmorgan | henrynash: cool :) | 15:30 |
| henrynash | notmorgan: I’m ( i think) actually trying to be even tougher…i.e. I didn’t want the path names to bleed back to any 3.6 client | 15:30 |
| notmorgan | henrynash: right and i get that. | 15:31 |
| *** aratus has quit IRC | 15:31 | |
| henrynash | notmorgan: and that’s when you have to look at micrpvesion removal…and sure, I get the issue that this is not ideal! | 15:31 |
| notmorgan | henrynash: i do think we can use the unique path as a name -- with some rare exceptions for deconflicting - and we can look at the ux around that. | 15:32 |
| *** aratus has joined #openstack-keystone | 15:32 | |
| notmorgan | but since things are created within a domain, if someone has a project named "/domain/x/y/x" but it's not a hierarchy, it might be sane to say "uhm.... no" | 15:32 |
| henrynash | notmorgan: so one thing I didn’t quote understand was your statement of “A list projects would show projects with both forms. “ | 15:32 |
| notmorgan | henrynash: right, both forms, was not clear, "old => name, new => path" | 15:32 |
| notmorgan | not "old => name,path, new => name,path" | 15:33 |
| notmorgan | basically i'm arguing that name == "path" for all projects created >= 3.7 | 15:33 |
| henrynash | notmorgan: right | 15:33 |
| notmorgan | and that keeps compat with 3.6, you say "i want to auth with project x/y/z" | 15:34 |
| notmorgan | that is the name | 15:34 |
| notmorgan | and if you rename a 3.7 project in 3.6, it can convert between [icky ux] but still has the same uniqueness requirements | 15:34 |
| henrynash | notmorgan: I guess one concern I have is that return the name as a path to a 3.6 client, might we surprise existing clients…. | 15:35 |
| *** woodburn has quit IRC | 15:35 | |
| *** woodburn has joined #openstack-keystone | 15:36 | |
| henrynash | notmorgan: obviously this would be for a “3.7 created” poject | 15:36 |
| notmorgan | name is just a string in 3.6 | 15:36 |
| notmorgan | keep treating it like a string | 15:36 |
| henrynash | notmorgan: I’m worried that people have build 3.6 UIs that e.g., only have 64 chars to display the project name | 15:37 |
| *** lucas___ has quit IRC | 15:38 | |
| *** permalac has joined #openstack-keystone | 15:38 | |
| *** lucas___ has joined #openstack-keystone | 15:38 | |
| henrynash | notmorgan: …although I’m not sure we declare anywhere that it is 64 chars? | 15:39 |
| *** adrian_otto has joined #openstack-keystone | 15:39 | |
| henrynash | notmorgan: at the APi level, that is | 15:39 |
| notmorgan | henrynash: we don't for the response :) | 15:39 |
| henrynash | notmrogan: ha! | 15:39 |
| notmorgan | we block > 64 chars on input | 15:39 |
| henrynash | notmorgan: agreed | 15:39 |
| lbragstad | https://github.com/openstack/keystone/blob/8a56c161ee29e34e70c6334b048881e8fbbd7514/keystone/resource/schema.py#L27 | 15:40 |
| notmorgan | lbragstad: input not response. | 15:40 |
| henrynash | notmorgan: Ok, so let me work through the issues for this way of doing thinsg….I’ll abandon the relax name constraints version of this and felsh out thsi new appraoch | 15:40 |
| notmorgan | henrynash: appreciate it. I think it is the right (tm) path. | 15:40 |
| notmorgan | henrynash: the biggest concern is renames change the hierarchy/path | 15:41 |
| henrynash | notmorgan: one slight fly in the ointment is that currently teh strict ul naming defaults to off…and we need this on in order to haev reliable oathers | 15:41 |
| notmorgan | henrynash: yes, but that might be something we make a 3.7 thing | 15:41 |
| *** roxanaghe has joined #openstack-keystone | 15:41 | |
| henrynash | notmorgan: agreed, maybe you ahve to haev it on… | 15:41 |
| henrynash | notmorgan: nut not sure quite what we do if someoen turns it off (and we can’t really remove that option sicne we ahev not depreacted it) | 15:42 |
| notmorgan | henrynash: in 3.7 it is defaulted on | 15:42 |
| henrynash | notmorgan: agreed | 15:43 |
| notmorgan | in 3.6 you can't create a project that conflicts with a path of another project | 15:43 |
| henrynash | notmorgan: agreed | 15:43 |
| *** lucas____ has joined #openstack-keystone | 15:43 | |
| notmorgan | in 3.7 if you happen to be trying to create a project with a path that conflicts with a name... | 15:43 |
| notmorgan | we provide a pleasant error message | 15:43 |
| notmorgan | if a project is named /domain/x/y/z | 15:43 |
| *** lucas___ has quit IRC | 15:43 | |
| notmorgan | but isn't in the hierarcht domain/x/y | 15:43 |
| notmorgan | we can properly error and say "project X conflicts, rename is required before this can happen" | 15:44 |
| notmorgan | it should be a seriously edge-of-edge-of-edge case | 15:44 |
| henrynash | notmorgan: yeah, I’ll try and work through those | 15:44 |
| notmorgan | and for compat '/' can be '\/' in 3.7 for the path | 15:44 |
| notmorgan | or similar escape for a 3.6 project with non-strict naming | 15:45 |
| notmorgan | i am also ok with pushing people towards using full_path for everything instead of name | 15:45 |
| notmorgan | post 3.7 | 15:45 |
| henrynash | yep | 15:46 |
| notmorgan | also consider immutable names | 15:46 |
| *** roxanaghe has quit IRC | 15:46 | |
| notmorgan | not sure if that is useful or not. | 15:46 |
| notmorgan | because it changes the path of *everything* under it | 15:46 |
| *** lucas____ has quit IRC | 15:47 | |
| *** danpawlik has quit IRC | 15:47 | |
| dstanek | when creating a project in 3.7 would you have to specify the hierarchy? | 15:48 |
| notmorgan | dstanek: you'd need to specify the parent | 15:48 |
| notmorgan | dstanek: at least. or it's rooted at the domain | 15:49 |
| notmorgan | dstanek: and the response can be name => 'path' | 15:49 |
| dstanek | is this by id or by name? | 15:49 |
| notmorgan | dstanek: you could do either "put it at the end of path X" or "put it under id Y" | 15:49 |
| dstanek | i'm trying to visualize how the reseller case would work with name only | 15:49 |
| notmorgan | dstanek: i think. | 15:49 |
| notmorgan | dstanek: i do not thing specifying the name as "path" should be valid | 15:50 |
| notmorgan | dstanek: but i'd be open to that if you think it is a better UX | 15:50 |
| dstanek | tbh i don't know at this point | 15:51 |
| notmorgan | dstanek: i think that is worth conversing about | 15:51 |
| *** rmizuno_ has quit IRC | 15:52 | |
| * notmorgan still thinks 99% of the cases don't need either of these things | 15:52 | |
| * notmorgan still thinks domains are sufficient and better models for this regardless | 15:52 | |
| dstanek | notmorgan: domains better than project heirarchy? | 15:53 |
| notmorgan | dstanek: the unique constraint is fine within a domain. | 15:53 |
| notmorgan | keep the hierarchy, but the reseller case is absolutely better served with more domains | 15:54 |
| notmorgan | imho | 15:54 |
| *** nisha__ has joined #openstack-keystone | 15:55 | |
| notmorgan | and in the case of /domain/accounting/dev and /domain/ops/dev it already requires unique names, either create an accounting domain or tell them to call it "acc_dev" or similar. [this is the only bit i see as a win with henry's change] | 15:55 |
| *** rmizuno_ has joined #openstack-keystone | 15:55 | |
| *** nisha_ has quit IRC | 15:56 | |
| henrynash | notmorgan: when you said “i do not thing specifying the name as "path" should be valid”, you mean create_proejct by specifying a path, rather than a parent_id + (simple) name? | 16:00 |
| notmorgan | henrynash: yah, assuming if i say "create project: name => /domain/x/y/z" would fail | 16:00 |
| notmorgan | not sure about path => | 16:01 |
| notmorgan | i'm open to discussing that ux bit | 16:01 |
| henrynash | notmorgan: you mean having a separate attribute ‘path”? or just something you can specify as part of the create construct? | 16:02 |
| *** rderose_ has joined #openstack-keystone | 16:02 | |
| *** aratus has quit IRC | 16:02 | |
| notmorgan | henrynash: if you are creating by path, you allow path (new attr) to be set in the create body | 16:03 |
| notmorgan | henrynash: otherwise it's the same as today: domain, parent, name | 16:03 |
| notmorgan | henrynash: i am not sure if it makes sense to "create by path" and inferr the name | 16:04 |
| notmorgan | but i would NOT make it accept name with the path | 16:04 |
| henrynash | notmorgan: if we are retunring the name as a path, what’s the objection to that? | 16:04 |
| *** rderose has quit IRC | 16:05 | |
| notmorgan | henrynash: mostly implementtion details | 16:05 |
| notmorgan | i worry about the validators and diverging code paths. | 16:05 |
| notmorgan | for the same attribute on input | 16:05 |
| notmorgan | i am willing to be convinced otherwise | 16:05 |
| notmorgan | this is not a hard stance, just a "if i were designing it..." | 16:05 |
| henrynash | notmorgan: ok…and it’s also something we could enable in a future microversion | 16:05 |
| notmorgan | sure. | 16:05 |
| notmorgan | the other reason is it doesn't encourage "path" names being set in 3.6 for older clients who also work with 3.7 | 16:06 |
| notmorgan | andbeyuond on some deployment | 16:06 |
| notmorgan | s | 16:06 |
| notmorgan | totally a consistency thing - but like i said, open to further discussion on that/wouldn't be upset if name can be the path on input | 16:07 |
| henrynash | understand | 16:07 |
| dstanek | raildo: i don't think that needs driver versioning to be fixed. | 16:07 |
| *** rderose_ has quit IRC | 16:08 | |
| *** jaugustine has joined #openstack-keystone | 16:08 | |
| raildo | dstanek: I just put the link, since the patch to driver versioning have a related-bug tag to this bug | 16:08 |
| *** rderose has joined #openstack-keystone | 16:09 | |
| *** ddieterly is now known as ddieterly[away] | 16:09 | |
| *** aratus has joined #openstack-keystone | 16:09 | |
| *** lucas___ has joined #openstack-keystone | 16:12 | |
| *** ddieterly[away] is now known as ddieterly | 16:12 | |
| *** GB21 has joined #openstack-keystone | 16:14 | |
| *** permalac has quit IRC | 16:16 | |
| *** anush__ has joined #openstack-keystone | 16:16 | |
| *** lucas___ has quit IRC | 16:17 | |
| *** jaugustine has quit IRC | 16:18 | |
| *** lucas___ has joined #openstack-keystone | 16:18 | |
| *** lucas___ has quit IRC | 16:19 | |
| *** lucas___ has joined #openstack-keystone | 16:19 | |
| *** timcline has quit IRC | 16:20 | |
| *** timcline has joined #openstack-keystone | 16:21 | |
| stevemar | o/ | 16:22 |
| lbragstad | stevemar o/ | 16:24 |
| stevemar | lbragstad: i get to run the meeting today! | 16:25 |
| *** timcline has quit IRC | 16:25 | |
| lbragstad | stevemar whoop! | 16:27 |
| *** daemontool has quit IRC | 16:28 | |
| *** daemontool has joined #openstack-keystone | 16:29 | |
| *** clenimar has joined #openstack-keystone | 16:29 | |
| *** anush__ has quit IRC | 16:33 | |
| *** anush__ has joined #openstack-keystone | 16:34 | |
| *** gyee has joined #openstack-keystone | 16:35 | |
| *** ChanServ sets mode: +v gyee | 16:35 | |
| henrynash_ | notmorgan: had you imagined that teh auth request (in 3.7) would just take path in the existing name field? or a separate path field? | 16:37 |
| notmorgan | henrynash_: separate attr | 16:37 |
| notmorgan | henrynash_: "path" or whatever | 16:37 |
| henrynash_ | notmorgan: agreed | 16:37 |
| notmorgan | henrynash_: i also would seriously like to revisit the split auth from CRUD api spec | 16:37 |
| notmorgan | henrynash_: so we can version auth independantly of the CRUD api - and encode auth-version in the body of the request rather than the header (the header seems weird for auth) | 16:38 |
| henrynash_ | notmorgan: do you have a spec for that? | 16:38 |
| *** anush__ has quit IRC | 16:38 | |
| *** timcline has joined #openstack-keystone | 16:39 | |
| notmorgan | henrynash_: yes. its on the backlog, sec | 16:39 |
| *** roxanaghe has joined #openstack-keystone | 16:39 | |
| notmorgan | http://specs.openstack.org/openstack/keystone-specs/specs/keystone/backlog/decouple-auth-from-api-version.html | 16:39 |
| henrynash_ | thx | 16:39 |
| notmorgan | henrynash_: would move auth to /auth | 16:39 |
| henrynash_ | notmorgan: (back to this specifics of naming)….although if auth takes ‘path’ (say), GET /auth/projects returns the attribute ‘name’ as the path…confusing? | 16:40 |
| notmorgan | henrynash_: and likely want to move catalog to either /catalog ot /auth/catalog | 16:40 |
| notmorgan | henrynash_: for compat, you might respond with name & path | 16:40 |
| notmorgan | *shrug* | 16:41 |
| notmorgan | you might only respond with path? | 16:41 |
| henrynash_ | notmorgan: (although not for 3.6 clients of course) | 16:41 |
| notmorgan | i think you should reach out to piet and UX team for that. | 16:41 |
| notmorgan | 3.6 clients wouldn't use /auth/projects :P | 16:42 |
| notmorgan | so... doesn't matter ;) | 16:42 |
| notmorgan | in fact... in 3.6 /auth/projects wouldn't exist. | 16:42 |
| notmorgan | if its a new thing | 16:42 |
| henrynash_ | notmorgan: but it exists today, no? | 16:42 |
| notmorgan | does it? | 16:42 |
| * notmorgan does't know. | 16:42 | |
| *** daemontool has quit IRC | 16:43 | |
| henrynash_ | checking… | 16:43 |
| *** tesseract has quit IRC | 16:43 | |
| notmorgan | i haven't looked at that, i assumed it was a nw thing. | 16:43 |
| notmorgan | but same deal, yeah 3.6 doesn't change response | 16:43 |
| notmorgan | i'm inclined to say 3.7 should still respond with name (auth is kind of special, and doesn't really version the same way as the CRUD api) | 16:43 |
| *** nisha__ has quit IRC | 16:43 | |
| *** nisha_ has joined #openstack-keystone | 16:43 | |
| notmorgan | sending coherant data for various client types might be worth it from a base v3 auth standpoint | 16:44 |
| henrynash_ | notmorgan: https://github.com/openstack/keystone-specs/blob/master/api/v3/identity-api-v3.rst#get-available-project-scopes | 16:44 |
| notmorgan | also... with auth not under CRUD apis, it becomes easier [if we ever need to] to do a harder/bigger change to the crud apis | 16:44 |
| notmorgan | such as a v4 or whatever | 16:44 |
| notmorgan | all the pain in converting v2 -> v3 has been because auth was "tied" to crud | 16:45 |
| *** mvk has quit IRC | 16:47 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Unified delegation model https://review.openstack.org/208488 | 16:56 |
| *** browne has joined #openstack-keystone | 16:56 | |
| *** pushkaru has joined #openstack-keystone | 16:59 | |
| *** rderose has quit IRC | 17:00 | |
| *** rderose has joined #openstack-keystone | 17:04 | |
| notmorgan | stevemar, ayoung, dolphm: we need to find a group to do threat analysis of keystoneauth and keystonemiddleware | 17:06 |
| notmorgan | those should be VMT managed | 17:06 |
| ayoung | notmorgan, ask nkinder | 17:06 |
| notmorgan | even though keystonemiddleware historically has been, it isn't explicitly listed | 17:07 |
| ayoung | we have groups that do that kind of stuff already | 17:07 |
| ayoung | or do you mean as part of upstream? | 17:07 |
| notmorgan | ayoung: right i mean publically for it. | 17:07 |
| notmorgan | so we can get the tags and officially have the VMT cover them. | 17:07 |
| notmorgan | just noticed that ksm and ksa didn't have the tags | 17:08 |
| notmorgan | ksc did. | 17:08 |
| notmorgan | i'll ask the others in the team re KSA | 17:08 |
| notmorgan | since it really was a split of ksc, same with ksm | 17:08 |
| *** timcline has quit IRC | 17:11 | |
| *** timcline has joined #openstack-keystone | 17:12 | |
| *** ddieterly is now known as ddieterly[away] | 17:15 | |
| notmorgan | ayoung, nkinder: and this is something we need to fire up pretty quickly imho. | 17:16 |
| *** timcline has quit IRC | 17:16 | |
| notmorgan | and we are going to want to do the same for keystone proper | 17:18 |
| notmorgan | soon(er) | 17:18 |
| *** mvk has joined #openstack-keystone | 17:18 | |
| notmorgan | rather than later | 17:18 |
| notmorgan | leading the charge on getting that info out/published/etc in openstack for us should be an easy sell. | 17:18 |
| *** raddaoui has joined #openstack-keystone | 17:21 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Unified delegation model https://review.openstack.org/208488 | 17:22 |
| *** alex_xu has quit IRC | 17:22 | |
| *** alex_xu has joined #openstack-keystone | 17:25 | |
| stevemar | notmorgan: that's not that easy, we can't just toss people at the problem | 17:27 |
| notmorgan | stevemar: it is very important to find folks to do it | 17:27 |
| notmorgan | and it needs to be something we can publically publish | 17:27 |
| notmorgan | for ksa/ksm | 17:27 |
| notmorgan | stevemar: right now keystoneauth and keystonemiddleware are not officially managed by the VMT -- and they should be | 17:27 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Move TestAuth unscoped token tests to TokenAPITests https://review.openstack.org/329589 | 17:28 |
| notmorgan | and as a future looking bit, keystone is going to need to do the same work once it is more formalized (all projects are going to need to) | 17:28 |
| notmorgan | so we should lead on this front | 17:28 |
| stevemar | notmorgan: i've got folks from at&t itching to contribute | 17:29 |
| notmorgan | so here is what we're looking for https://review.openstack.org/#/c/300698/ as guidance | 17:29 |
| patchbot | notmorgan: patch 300698 - governance - Tidy of item 5 of the vulnerability:managed tag | 17:29 |
| notmorgan | stevemar: ftr: the reason ksa/ksm are not managed was an oopse when we split them. but they'd also be eventually required to do this. | 17:30 |
| notmorgan | so, it works out well to do this now, get the tag officially applied | 17:30 |
| *** tqtran has joined #openstack-keystone | 17:32 | |
| *** shewless has joined #openstack-keystone | 17:39 | |
| shewless | dstanek: Hi I've had a chance to start from scratch and working to get federation to work with testshib.org as a IDP. I'm wondering what you have your "trusted_dashboard" set to in /etc/keystone/keystone.conf | 17:40 |
| *** tonytan4ever has joined #openstack-keystone | 17:41 | |
| *** pnavarro has quit IRC | 17:41 | |
| gyee | notmorgan, stevemar, what's the difference between VMT and OSS? | 17:41 |
| notmorgan | gyee: vulnerability management team, that is fungi, tristan, grant and me | 17:42 |
| notmorgan | gyee: we're the ones who do the OSSAs etc. | 17:42 |
| gyee | and OSSN? | 17:42 |
| notmorgan | gyee: openstack security group (OSSG, OSSP), are the rest of the team | 17:42 |
| notmorgan | OSSN is done by OSSG not VMT iirc | 17:42 |
| notmorgan | we request CVEs send out notifications for OSSAs | 17:43 |
| notmorgan | etc | 17:43 |
| notmorgan | handle embargoed patches (the vmt does) | 17:43 |
| notmorgan | it's avery small group, OSSG is a bit bigger | 17:43 |
| *** roxanagh_ has joined #openstack-keystone | 17:43 | |
| gyee | notmorgan, I see | 17:43 |
| gyee | notmorgan, is VMT also responsible for the bandit gate? | 17:44 |
| notmorgan | no | 17:44 |
| stevemar | gyee: thats the security team | 17:44 |
| notmorgan | thats the general security team | 17:45 |
| notmorgan | the VMT really is all about managing vulnerabilities, ebargos, and communications around vulnerabilitys | 17:45 |
| gyee | is there an official wiki/doc that explains the team charters? I just want to have it for reference | 17:45 |
| notmorgan | gyee: the vmt process (anbd what we do) is here: https://security.openstack.org/vmt-process.html | 17:46 |
| notmorgan | the security team is more i think on security.openstack.org (proper( | 17:46 |
| fungi | gyee: http://governance.openstack.org/reference/projects/security.html links to https://wiki.openstack.org/wiki/Security for the ossp/ossg | 17:46 |
| notmorgan | fungi: ++ | 17:46 |
| notmorgan | fungi: to the rescue! | 17:46 |
| gyee | good stuff! thanks guys! | 17:46 |
| openstackgerrit | Nisha Yadav proposed openstack/python-keystoneclient: Add domain functional tests https://review.openstack.org/329598 | 17:46 |
| fungi | gyee: and yes, notmorgan has also linked you to the vmt documentation as well (which is linked from the wiki i mentioned) | 17:46 |
| *** timcline has joined #openstack-keystone | 17:47 | |
| *** roxanagh_ has quit IRC | 17:47 | |
| gyee | nice! that's exactly what I am looking for | 17:48 |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Support hierarchical project naming https://review.openstack.org/318605 | 17:49 |
| samueldmq | nisha_: there we go! ^ commits also appear here in the channel, see a few lines above | 17:49 |
| nisha_ | samueldmq, Yes :D | 17:51 |
| *** timcline has quit IRC | 17:51 | |
| *** GB21 has quit IRC | 17:53 | |
| *** nisha__ has joined #openstack-keystone | 17:56 | |
| *** jaugustine has joined #openstack-keystone | 17:57 | |
| stevemar | meeting time :O | 17:58 |
| *** nisha_ has quit IRC | 17:59 | |
| nisha__ | o/ | 17:59 |
| *** shaleh has joined #openstack-keystone | 17:59 | |
| *** nisha__ is now known as nisha_ | 18:00 | |
| *** timcline has joined #openstack-keystone | 18:01 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Unified delegation model https://review.openstack.org/208488 | 18:03 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: WIP/DNM Unified delegation assignment driver https://review.openstack.org/291318 | 18:03 |
| *** ddieterly[away] is now known as ddieterly | 18:08 | |
| *** dmk0202 has joined #openstack-keystone | 18:09 | |
| *** richm has quit IRC | 18:10 | |
| *** elmiko has joined #openstack-keystone | 18:11 | |
| *** jaugustine has quit IRC | 18:11 | |
| elmiko | hi, i'm doing some testing with keystone and in the past i had monitored the log outputs to see token issuances, has this logging gone away or do i perhaps need to turn up the log level or something? | 18:12 |
| *** mvk_ has joined #openstack-keystone | 18:14 | |
| *** mvk has quit IRC | 18:17 | |
| elmiko | hmm, nvm, me thinks this is a case of pbkac | 18:17 |
| *** aratus has quit IRC | 18:22 | |
| dolphm | #success gyee doesn't always agree with dstanek, but not this time | 18:27 |
| openstackstatus | dolphm: Added success to Success page | 18:27 |
| gyee | oh dolphm, you one funny dude :-) | 18:27 |
| *** richm has joined #openstack-keystone | 18:28 | |
| *** dmk0202 has quit IRC | 18:30 | |
| *** harlowja has quit IRC | 18:30 | |
| *** harlowja has joined #openstack-keystone | 18:32 | |
| *** anush__ has joined #openstack-keystone | 18:33 | |
| shaleh | notmorgan: ping me tomorrow to discuss specs. I will be in meetings rest of the day | 18:37 |
| notmorgan | shaleh: haha funny so am I today | 18:37 |
| *** dan_nguyen has joined #openstack-keystone | 18:40 | |
| notmorgan | lbragstad: i have a specific question: what is a specific question? #meta | 18:40 |
| *** lucas___ has quit IRC | 18:43 | |
| *** lifeless has quit IRC | 18:46 | |
| *** lucas___ has joined #openstack-keystone | 18:47 | |
| *** lucas___ has quit IRC | 18:47 | |
| *** lifeless has joined #openstack-keystone | 18:47 | |
| *** lucas___ has joined #openstack-keystone | 18:47 | |
| shewless | dstanek: I think of made some more progress. I get this fancy error: A valid authentication statement was not found in the incoming message. I'm looking at the testshib logs to make more sense of it but haven't had too much luck yet. | 18:48 |
| raildo | jamielennox: ping, do you have any updates about this contact with TC about this: http://lists.openstack.org/pipermail/openstack-dev/2016-May/095047.html ? | 18:51 |
| shewless | dstanek: also do I need to setup and create sso_callback_template in keystone.conf | 18:52 |
| jamielennox | raildo: ahhh, no | 18:52 |
| jamielennox | raildo: crap | 18:52 |
| raildo | jamielennox: np, if there is anything that I can help, I'm here :) | 18:53 |
| *** rk4n has quit IRC | 18:54 | |
| jamielennox | raildo: i was supposed to present a proposal to the TC, there's apparently no format for doing that and then i got busy on some other stuff | 18:55 |
| jamielennox | raildo: i'll try and get it done this week and on the TC meeting in the next week or two | 18:55 |
| *** ddieterly is now known as ddieterly[away] | 18:55 | |
| raildo | jamielennox: awesome, thank you sir! | 18:55 |
| *** nisha_ has quit IRC | 18:55 | |
| *** amoralej is now known as amoralej|off | 18:57 | |
| *** lucas___ has quit IRC | 19:00 | |
| gyee | stevemar, I keep asking the product managers to throw me a bone on HMT, I got nothing! | 19:00 |
| ayoung | notmorgan, so the acceptable approach that has made it through is /domain/projectZ/Porgy/Bess/ | 19:00 |
| jamielennox | henrynash_: so it would work if you follow the GET /auth/projects then use that to feed your auth call | 19:00 |
| dstanek | gyee: what do you want? | 19:00 |
| henrynash_ | ayoung, notmorgan: as speced, it a string starting / has the domain in it, without a / it is relative to teh domain | 19:01 |
| notmorgan | ayoung: basically | 19:01 |
| *** darosale has quit IRC | 19:01 | |
| jamielennox | henrynash_: but it doesn't work for all the people out there who have PROJECT_NAME in an accrc or something | 19:01 |
| gyee | dstanek, real world use cases | 19:01 |
| ayoung | henrynash_, how would it work in a URL? | 19:01 |
| jamielennox | henrynash_: and then we allow people to add a second project name from the one they've got stored | 19:01 |
| notmorgan | ayoung: url-encoded. | 19:01 |
| *** jaugustine has joined #openstack-keystone | 19:01 | |
| henrynash_ | jamielennox: yes, you can take teh name from GET /auth/projects and plug it into auth ad we guarntee that works in 3.6 and 3.7 | 19:01 |
| *** lucas___ has joined #openstack-keystone | 19:02 | |
| notmorgan | ayoung: it's the standard answer to non-safe-control characters. but we also have very few things that "look up by name" in a URI | 19:02 |
| henrynash_ | jamielennox: did follow your: but it doesn't work for all the people out there who have PROJECT_NAME in an accrc or something | 19:02 |
| dstanek | gyee: i would love that! | 19:02 |
| *** lucas___ has quit IRC | 19:02 | |
| stevemar | gyee: product managers don't care about HMT! | 19:03 |
| *** lucas___ has joined #openstack-keystone | 19:03 | |
| *** amakarov is now known as amakarov_away | 19:03 | |
| dstanek | stevemar: then who does? | 19:03 |
| jamielennox | amakarov: so closure tables and a number of other things work for actually storing the data, the problem is changing the API | 19:03 |
| henrynash_ | jamielennix: didn’t follow…. | 19:03 |
| dstanek | or can we rip it out like versioned drivers? | 19:03 |
| dstanek | shewless: trusted_dashboard=http://{my_ip}/dashboard/auth/websso/ | 19:03 |
| notmorgan | stevemar: most users don't care about HMT :P | 19:04 |
| henrynash_ | jamielennox: “but it doesn't work for all the people out there who have PROJECT_NAME in an accrc or something” could you expand? | 19:04 |
| shaleh | dstanek: apparently we are supposed to throw as much out as possible to be added back in more on demand later | 19:04 |
| shewless | dstanek: cool.. IP or DNS name? :) | 19:04 |
| jamielennox | henrynash_: so if i have a clouds.yaml/accrc that was given to me that i always use to authenticate it doesn't go via /auth/projects - that PROJECT_NAME is now fragile | 19:04 |
| *** lucas___ has quit IRC | 19:04 | |
| *** lucas___ has joined #openstack-keystone | 19:04 | |
| notmorgan | jamielennox: assume it's not python | 19:04 |
| jamielennox | notmorgan: sure - i'm just saying previously stored authentication | 19:04 |
| dstanek | shaleh: gotta trim the fat before you start packing on the muscle | 19:04 |
| notmorgan | jamielennox: if previously the API accepts <name[this can change]> and <domain> | 19:04 |
| henrynash_ | jamielennox: so we gurantee that a project created via 3.6 can also be auth’d using the “simple” name | 19:05 |
| notmorgan | and now it's </thing/thing/thing/[name]> <domain> | 19:05 |
| notmorgan | but nothing but the server version changed | 19:05 |
| notmorgan | you're broken | 19:05 |
| shaleh | dstanek: nonsense. Look at the world strongest man competitions. They aint small. | 19:05 |
| dstanek | shewless: i also have: sso_callback_template = /opt/stack/keystone/etc/sso_callback_template.html | 19:05 |
| shaleh | :-) | 19:05 |
| notmorgan | and you broke the API contract | 19:05 |
| notmorgan | it's more of "the api broke you" not "your auth creds are fragile" | 19:05 |
| shaleh | dstanek: our idealized physique is that of Greek statues not actual humans | 19:05 |
| *** dmk0202 has joined #openstack-keystone | 19:05 | |
| dstanek | shaleh: they have a different muscular goal than i | 19:05 |
| jamielennox | henrynash_: also i feel i/we owe you an apology because you tried to bring this up once before and we convinced you to maintain the uniqueness constraint because it was easy to remove later | 19:05 |
| henrynash_ | jamielennox: :-) | 19:06 |
| shewless | dstanek: I snagged this.. do you think it's right? https://github.com/openstack/keystone/blob/stable/mitaka/etc/sso_callback_template.html | 19:06 |
| notmorgan | jamielennox: if we removed the uniqueness constraint backe then.. we also would have massively broke everything | 19:06 |
| shewless | since I can't find that file anywhere on my system locally | 19:06 |
| shaleh | time for the commute. Laters all | 19:06 |
| notmorgan | jamielennox: it was the right call to NOT remove it then (same as today) | 19:06 |
| *** shaleh has quit IRC | 19:06 | |
| *** sdake has quit IRC | 19:06 | |
| notmorgan | just smaller scope because fewer things were leaning on V3... but still massive brokenness | 19:06 |
| jamielennox | notmorgan: it's one of those things that i think we just didn't think through the HMT consequences far enough | 19:06 |
| dstanek | shewless: that's probably fine. i'm just using the one included in the current master | 19:07 |
| jamielennox | but it's done | 19:07 |
| *** sdake has joined #openstack-keystone | 19:07 | |
| notmorgan | jamielennox: basically HMT needed to be baked into v3 at the start... or be a v4 thing | 19:07 |
| gyee | I am motorcyclepooling with shaleh | 19:07 |
| notmorgan | jamielennox: we never could have changed it even with the full concequence by the time it was proposed | 19:07 |
| notmorgan | jamielennox: short of massivily disrupting the api users. | 19:07 |
| henrynash_ | notmorgan: or maybe when we first invented domains, we could have also changed this…. | 19:07 |
| notmorgan | henrynash_: baked into v3 at the start ;) | 19:08 |
| henrynash_ | yep | 19:08 |
| *** adrian_otto has quit IRC | 19:08 | |
| shewless | dstanek: thanks.. still getting that werid error though.. maybe an attribute mapping problem.. maybe you can help? | 19:08 |
| notmorgan | personally i get the UX desire for /domain/dev/PROJECTA | 19:08 |
| dstanek | shewless: can you paste it? | 19:08 |
| notmorgan | and /domain/ops/PROJECTA | 19:08 |
| notmorgan | but i kindof think that could be solved with domains still | 19:08 |
| notmorgan | and reseller is clearly solved with domains | 19:09 |
| jamielennox | i haven't read the last few ML posts, but i've had a draft for a while i just don't know if i have any ideas here | 19:09 |
| notmorgan | basically lean on domains harder | 19:09 |
| shewless | dstanek: http://pastebin.com/HN26Xg0B | 19:09 |
| notmorgan | and push to where "if you really need non-unique constraints" domains make the most sense | 19:09 |
| notmorgan | or.. be willing to make names unique (/domain/accounting/projcect_a_accounting /domain/dev/project_a_dev) | 19:10 |
| jamielennox | notmorgan: for me, if we're going to push forward the domains are projects thing then we should actually embrace using projects everywhere | 19:10 |
| notmorgan | jamielennox: i mean from a HMT standpoint for henrynash_'s use cases | 19:11 |
| jamielennox | also i don't know where we are with reseller but it kind of tanks that | 19:11 |
| notmorgan | jamielennox: i'm fine with everything being a project or not -- that is a separate convo i think | 19:11 |
| henrynash_ | notmorgan: which would (and I know it’s still in its infancy) make quota management hard without expsoing domains to the quota setting | 19:11 |
| jamielennox | because every domain is a unique name and that would leak across boundaries | 19:11 |
| dstanek | shewless: what is that from? | 19:11 |
| shewless | dstanek: shibboleth idp log | 19:11 |
| notmorgan | henrynash_: i think it's fine to approach it as a unified set of quoats | 19:11 |
| dstanek | shewless: how far is your request flow going? | 19:12 |
| notmorgan | jamielennox: call domains account IDs, call the account_id_xxxxxxx, call them sha256(account_id_domain) | 19:12 |
| notmorgan | jamielennox: the "leaking the name across boundries" -- is this a real actual use case or theoretical | 19:13 |
| shewless | dstanek: not sure how to check.. the idp logs seem like it's making it somewhat far. trying to see if there are relavent logs on my system. NOt much in apache/keystone that I can see | 19:13 |
| notmorgan | i see every cloud i use that consumes domains properly using an id (or the same name as the domain id) as the domain_name | 19:13 |
| dstanek | shewless: when you initiate the flow do you get redirected to the browser to login? | 19:14 |
| jamielennox | notmorgan: well say you're now creating an accounting domain at your company so that you can auth against it, now someone in another domain elsewhere can't create the accounting domain because those names are unique | 19:14 |
| *** anush__ has quit IRC | 19:14 | |
| notmorgan | for UX perspective, make it more friendly, but adding a prefix of some sort is fine. | 19:14 |
| *** jaugustine has quit IRC | 19:14 | |
| jamielennox | so you've just pushed the uniqueness constraint elsewhere | 19:14 |
| notmorgan | jamielennox: to a much narrower set | 19:14 |
| shewless | dstanek: ah.. yes I do! I login as "myself/myself" and then I get that error | 19:14 |
| jamielennox | notmorgan: depends how hard you advocate for people to use domains for this problem | 19:14 |
| notmorgan | jamielennox: is this a realworld use case or theoretical | 19:15 |
| notmorgan | because this has been 100% theoretical every time it comes up | 19:15 |
| jamielennox | ATM everything here is theoretical | 19:15 |
| dstanek | shewless: after you login are you redirected back to keystone? | 19:15 |
| notmorgan | so i'm willing to say "uniquness is fine" | 19:15 |
| notmorgan | especially at the domain level | 19:15 |
| notmorgan | don't call it "accounting" | 19:15 |
| jamielennox | but i don't want to come back in 3 cycles and go through the same problem we are having now with domains | 19:15 |
| notmorgan | lets also look at real world uses, how often is something called "accounting" in an org | 19:16 |
| notmorgan | never really. | 19:16 |
| jamielennox | but you're advocating using domains more so that people can get around the uniqueness constraint | 19:16 |
| notmorgan | call it an ldap-style name :P | 19:16 |
| henrynash_ | jamielennox: and this is as differnet exmaple of the reseller case…and one of the reasons I want to solve the uniquenes problem is eventually I do want to be abel to have proejcts that are actings as domains to also only have to be uniqye within their parent domain | 19:16 |
| notmorgan | the uniqueness constraing in projects | 19:16 |
| jamielennox | so let's say it's domain=dev | 19:16 |
| notmorgan | henrynash_: i will never ever ever be for domains in domains | 19:16 |
| henrynash_ | notmorgan: and I know that :-) | 19:17 |
| jamielennox | that's going to come up a lot | 19:17 |
| *** aratus has joined #openstack-keystone | 19:17 | |
| notmorgan | henrynash_: now, likelyhood of me stepping down from keystone if that get steam, is high | 19:17 |
| notmorgan | because i don't want to be a blocker if i'm the minority | 19:17 |
| *** ddieterly[away] is now known as ddieterly | 19:17 | |
| notmorgan | henrynash_: i have yet to see a real use case for any of this -- | 19:18 |
| henrynash_ | notmorgan: well I hope that isn’t true (stepping down), but I’m not proposing that right now | 19:18 |
| henrynash_ | notmorgan: absolutely the riht question | 19:18 |
| dstanek | notmorgan: i would have actually preferred the domains in domains idea. just like filesystem structures | 19:18 |
| notmorgan | henrynash_: it is true, i wont sign off/support something when i'm a minority case and i feel the project is going the wrong direction. | 19:18 |
| jamielennox | stevemar: so +A https://review.openstack.org/#/c/318658 ? | 19:18 |
| henrynash_ | dstanek: I actually proposed that instead of HMT! | 19:19 |
| notmorgan | henrynash_: but i also wont be a blocker. | 19:19 |
| shewless | dstanek: after I login the address bar is: https://myloud.foo.com/Shibboleth.sso/SAML2/POST | 19:19 |
| jamielennox | dstanek: ++ the idea of this for me is to make domains less special and go to just a project/folder structure | 19:19 |
| notmorgan | henrynash_: i just don't want to feel stressed/annoyed/angry at people for tech solutions that i just don't agree with. | 19:19 |
| *** jaugustine has joined #openstack-keystone | 19:19 | |
| henrynash_ | notmorgan: ahh, you have to get over some of that! | 19:20 |
| shewless | dstanek: and the error is: opensaml::FatalProfileException .. .. .. opensaml::FatalProfileException at (https://mycloud.foo.com/Shibboleth.sso/SAML2/POST) .. .. A valid authentication statement was not found in the incoming message. | 19:20 |
| notmorgan | henrynash_: it is also not my full time job to work on keystone | 19:20 |
| notmorgan | henrynash_: if it was, it would be different | 19:20 |
| notmorgan | henrynash_: my job is to work on zuul/nodepool/ci software | 19:20 |
| henrynash_ | notmorgan: I still don’t agree with teh way were doing shadow users, but I’m in the minorty so I’ll supprot it | 19:21 |
| henrynash_ | (yep, understand the different) | 19:21 |
| notmorgan | henrynash_: i can't be 150% invested on both fronts ;) if i disagree with the general direction of the project i'm not focused on, i need to not be as involved | 19:21 |
| dstanek | shewless: and the log you posted earlier was from mod_shib? | 19:21 |
| henrynash_ | notmorgan: that;;s fair | 19:21 |
| bknudson | if the other guy is giving 110%, you give 120% | 19:21 |
| *** anush__ has joined #openstack-keystone | 19:21 | |
| notmorgan | henrynash_: basicallyt i should be at about 20-30% of time on keystone. | 19:21 |
| shewless | dstanek: no the log was from testshib.org's logs. I'll look for some shib logs | 19:22 |
| henrynash_ | notmorgan: yep, I know you ahve the other stuff now | 19:22 |
| notmorgan | so, it tells you where i have to draw a line. and context switching keystone <-> zuul is already straining me | 19:22 |
| dstanek | shewless: if you are getting that error on the service provider's url it would likely be a mod_shib thing | 19:22 |
| henrynash_ | notmorgan: I can imagine so | 19:22 |
| notmorgan | henrynash_: it isn't you or your idea or a (don't propose it) | 19:22 |
| shewless | dstanek: ah.. ERROR Shibboleth.SSO.SAML2 [1]: failed to decrypt assertion: Unable to resolve any key decryption keys. | 19:23 |
| notmorgan | henrynash_: it's a hey, i want to support keystone the best i can, it isn't a "threat" :) please don't take it that way ^_^ | 19:23 |
| dstanek | shewless: are you storing the IdP's metadata on the SP? | 19:23 |
| shewless | dstanek: no.. it's a link to the IDP | 19:24 |
| shewless | dstanek: <MetadataProvider type="XML" uri="http://www.testshib.org/metadata/testshib-providers.xml" backingFilePath="testshib-two-idp-metadata.xml" reloadInterval="180000" /> | 19:24 |
| jamielennox | bknudson: can i get you to have a look at https://review.openstack.org/#/c/326782/ - not having much luck getting oslo cores | 19:24 |
| patchbot | jamielennox: patch 326782 - oslo.middleware - Expose sample config opts for http-proxy-to-wsgi | 19:24 |
| notmorgan | dstanek: so domains in domains... is more like LVM in LVM | 19:24 |
| notmorgan | dstanek: and projects contain the resources (files) such as vms, volumes, etc | 19:25 |
| notmorgan | dstanek: at least in my brain mapping of openstack | 19:25 |
| *** tonytan4ever has quit IRC | 19:25 | |
| shewless | dstanek: I don't know what that "brackingFilePath" is though... that file "testshib-two-idp-metadata.xml" certainly doesn't exist on my side | 19:25 |
| notmorgan | the domain is the actual block devices... if you want to use that analogy | 19:25 |
| dstanek | notmorgan: i don't know about the LVM reference but i thought the model was simplier | 19:25 |
| *** aratus has quit IRC | 19:25 | |
| bknudson | jamielennox: I've starred it so it's on my short list... but I haven't had time for doing reviews lately. | 19:25 |
| dstanek | add 1 join table and some apis to model the hierarchy | 19:26 |
| dstanek | and the the existing project based things continue to work | 19:26 |
| notmorgan | dstanek: block device (domain), project (filesystem/directory structure) | 19:26 |
| notmorgan | dstanek: is how i always saw it. | 19:26 |
| jamielennox | bknudson: that's good, thanks | 19:26 |
| *** aratus has joined #openstack-keystone | 19:26 | |
| dstanek | notmorgan: i map domain to directory (orgainzation of content) and project to files (content) | 19:27 |
| jamielennox | notmorgan: i'm not sure how that's the model and you advocate people to use more domains when they need uniqueness constraints | 19:27 |
| dstanek | then a reseller would own (sub domains) | 19:27 |
| jamielennox | i need to try and get some more sleep - stuff on today, later | 19:29 |
| notmorgan | jamielennox: i see it as domains are free and can namespace many things. | 19:30 |
| notmorgan | jamielennox: and can be given less-friendly names overall. | 19:30 |
| notmorgan | but again... w/e my $0.02 | 19:30 |
| jamielennox | so i mostly care about domains from a root of auth perspective | 19:30 |
| jamielennox | OS_DOMAIN_NAME=IBM.COM makes sense to me | 19:31 |
| jamielennox | the structure beneath that is projects | 19:31 |
| bknudson | might as well just make it a url. | 19:32 |
| jamielennox | anyway, back later | 19:33 |
| *** ayoung_ has joined #openstack-keystone | 19:34 | |
| *** gyee has quit IRC | 19:36 | |
| *** lucas___ has quit IRC | 19:39 | |
| shewless | dstanek: looks like I'm having 2 problems. 1 is that decryption key problem. Which shibboleth docs say: "The SP received encrypted XML (usually an EncryptedAssertion) and couldn't decrypt it. The SP's metadata probably doesn't contain the same public key(s) the SP is configured to use (or the credentials didn't load)." | 19:44 |
| *** roxanagh_ has joined #openstack-keystone | 19:44 | |
| *** harlowja_ has joined #openstack-keystone | 19:45 | |
| shewless | dstanek: the second problem is that when I first click "login" in horizon it is accessing the "server name" instead of my "public name" - and I'm not sure if that's causing the first problem. On my computer it doesn't matter because my browser can access both host names.. but I don't know if that cuases problems with keys | 19:46 |
| *** roxanagh_ has quit IRC | 19:49 | |
| *** harlowja has quit IRC | 19:49 | |
| shewless | dstanek: I'll try reuploading my metadata in case I did it before I generated the keys | 19:50 |
| *** jsavak has joined #openstack-keystone | 19:50 | |
| stevemar | jamielennox: i'm going to punt https://review.openstack.org/#/c/318658/ through, any last minute objections? | 19:52 |
| patchbot | stevemar: patch 318658 - keystone - Pass a request to controllers instead of a context | 19:52 |
| stevemar | jamielennox: i see you already asked me that lol | 19:53 |
| *** aratus has quit IRC | 19:54 | |
| shewless | dstanek: Okay after I re-uploaded the meta data I got past that part. I'm now seeing "The page you were looking for doesn't exist You may have mistyped the address or the page may have moved." | 19:54 |
| shewless | dstanek: and this in the shibd.log: http://paste.ubuntu.com/17338540 | 19:55 |
| *** adrian_otto has joined #openstack-keystone | 20:00 | |
| *** aratus has joined #openstack-keystone | 20:02 | |
| stevemar | does anyone have an opinion on http://lists.openstack.org/pipermail/openstack-dev/2016-June/096712.html ? | 20:03 |
| *** jsavak has quit IRC | 20:03 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Password SQL model changes https://review.openstack.org/314284 | 20:04 |
| *** jsavak has joined #openstack-keystone | 20:05 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Password SQL model changes https://review.openstack.org/314284 | 20:12 |
| *** anush__ has quit IRC | 20:13 | |
| *** anush__ has joined #openstack-keystone | 20:13 | |
| *** anush__ has quit IRC | 20:17 | |
| *** anush__ has joined #openstack-keystone | 20:17 | |
| *** anush__ has quit IRC | 20:22 | |
| *** dmk0202 has quit IRC | 20:26 | |
| *** dmk0202 has joined #openstack-keystone | 20:26 | |
| *** dmk0202 has quit IRC | 20:33 | |
| *** jsavak has quit IRC | 20:33 | |
| *** jsavak has joined #openstack-keystone | 20:33 | |
| *** jaugustine has quit IRC | 20:36 | |
| *** ddieterly is now known as ddieterly[away] | 20:37 | |
| rderose | lbragstad: what should the default be for max_active_keys? | 20:38 |
| rderose | lbragstad: for fernet tokens | 20:38 |
| lbragstad | rderose the current default is 3 | 20:38 |
| rderose | lbragstad: does it just depend on how often you rotate | 20:38 |
| lbragstad | https://github.com/openstack/keystone/blob/master/keystone/common/config.py#L300 | 20:38 |
| lbragstad | rderose the number of max_active_keys does depend on how often you rotate but we don't use rotation frequency to generate the default | 20:39 |
| *** mkrcmari__ has joined #openstack-keystone | 20:39 | |
| rderose | lbragstad: sorry, does it depend on how many servers you have keystone deployed on? | 20:41 |
| lbragstad | rderose nope | 20:41 |
| lbragstad | rderose number of servers hosting a keystone deployment shouldn't matter | 20:41 |
| rderose | lbragstad: have ali here and we're trying to understand why the default is 3 | 20:41 |
| lbragstad | rderose i'll grab a link | 20:42 |
| rderose | lbragstad: cool | 20:42 |
| *** mvk_ has quit IRC | 20:43 | |
| lbragstad | rderose i was referencing a video we did in austin | 20:44 |
| rderose | lbragstad: oh yeah | 20:44 |
| *** mvk_ has joined #openstack-keystone | 20:45 | |
| lbragstad | rderose we chose 3 as the default because if you have less than 3 keys in your key repository you end up running into issues where you'll remove keys used to encrypt tokens that are still valid. | 20:45 |
| lbragstad | https://www.youtube.com/watch?v=702SRZHdNW8 | 20:45 |
| lbragstad | ^ it's lengthy | 20:45 |
| *** roxanagh_ has joined #openstack-keystone | 20:45 | |
| rderose | lbragstad: thx | 20:47 |
| rderose | lbragstad: last question, are you familiar with enforce_token_bind setting? | 20:47 |
| *** raildo is now known as raildo-afk | 20:47 | |
| lbragstad | rderose i haven't used it but i believe it is for using bind to authenticate for a token (which isn't supported by fernet tokens) | 20:48 |
| rderose | lbragstad: perfect, thx | 20:48 |
| *** mkrcmari__ has quit IRC | 20:48 | |
| *** gagehugo has quit IRC | 20:49 | |
| lbragstad | rderose no problem | 20:50 |
| *** roxanagh_ has quit IRC | 20:50 | |
| *** edmondsw has quit IRC | 20:52 | |
| *** yolanda has quit IRC | 20:52 | |
| stevemar | jamielennox: i went with the airport hotel :( | 20:56 |
| *** ayoung_ has quit IRC | 20:57 | |
| *** ayoung has quit IRC | 20:57 | |
| *** mvk has joined #openstack-keystone | 20:58 | |
| *** anush__ has joined #openstack-keystone | 20:59 | |
| *** mvk_ has quit IRC | 20:59 | |
| openstackgerrit | Merged openstack/keystone: Pass a request to controllers instead of a context https://review.openstack.org/318658 | 21:01 |
| *** anush__ has quit IRC | 21:03 | |
| *** darrenc is now known as darrenc_afk | 21:03 | |
| *** anush__ has joined #openstack-keystone | 21:04 | |
| *** gyee has joined #openstack-keystone | 21:06 | |
| *** ChanServ sets mode: +v gyee | 21:06 | |
| *** ddieterly[away] is now known as ddieterly | 21:06 | |
| *** edtubill has quit IRC | 21:08 | |
| *** pauloewerton has quit IRC | 21:11 | |
| *** julim has quit IRC | 21:12 | |
| *** woodster_ has quit IRC | 21:18 | |
| *** adrian_otto has quit IRC | 21:26 | |
| *** anush__ has quit IRC | 21:33 | |
| *** edtubill has joined #openstack-keystone | 21:34 | |
| *** pushkaru has quit IRC | 21:36 | |
| *** pushkaru has joined #openstack-keystone | 21:36 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Password SQL model changes https://review.openstack.org/314284 | 21:39 |
| *** rderose has quit IRC | 21:43 | |
| *** sileht has quit IRC | 21:51 | |
| *** sileht has joined #openstack-keystone | 21:52 | |
| bknudson | stevemar: which airport? | 21:52 |
| *** frontrunner has quit IRC | 21:53 | |
| *** darrenc_afk is now known as darrenc | 21:54 | |
| *** ddieterly is now known as ddieterly[away] | 21:58 | |
| *** ddieterly[away] is now known as ddieterly | 22:01 | |
| *** browne has quit IRC | 22:08 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 22:23 | |
| *** openstackstatus has quit IRC | 22:25 | |
| *** openstack has joined #openstack-keystone | 22:25 | |
| *** catintheroof has joined #openstack-keystone | 22:25 | |
| *** gordc has quit IRC | 22:25 | |
| *** pushkaru has quit IRC | 22:25 | |
| *** openstackstatus has joined #openstack-keystone | 22:26 | |
| *** ChanServ sets mode: +v openstackstatus | 22:26 | |
| *** rk4n has joined #openstack-keystone | 22:26 | |
| *** browne has joined #openstack-keystone | 22:27 | |
| *** timcline has quit IRC | 22:27 | |
| *** timcline has joined #openstack-keystone | 22:28 | |
| *** rcernin has joined #openstack-keystone | 22:28 | |
| stevemar | bknudson: the SJ airport i assume | 22:29 |
| stevemar | bknudson: https://goo.gl/vdkR52 | 22:29 |
| *** catintheroof has quit IRC | 22:30 | |
| stevemar | bknudson: apparently there is a shuttle or bus that goes there every 15 minutes, takes about 30 minutes | 22:31 |
| stevemar | bknudson: i also rented a car | 22:31 |
| *** rk4n has quit IRC | 22:32 | |
| stevemar | 170 W Tasman Dr is the cisco office | 22:32 |
| stevemar | by car its about 15 minutes | 22:32 |
| *** timcline has quit IRC | 22:33 | |
| *** jsavak has quit IRC | 22:33 | |
| *** ddieterly has quit IRC | 22:35 | |
| *** iurygregory_ has joined #openstack-keystone | 22:40 | |
| notmorgan | stevemar: we need to bug cburgess and find out what room and all we're going to be in | 22:46 |
| notmorgan | but cburgess is on a cruise in the baltic | 22:47 |
| notmorgan | sooooooo | 22:47 |
| *** roxanagh_ has joined #openstack-keystone | 22:47 | |
| stevemar | notmorgan: poor signal out there :P | 22:47 |
| *** rk4n has joined #openstack-keystone | 22:48 | |
| *** rk4n has quit IRC | 22:50 | |
| *** roxanagh_ has quit IRC | 22:51 | |
| *** rk4n has joined #openstack-keystone | 22:52 | |
| *** rk4n has quit IRC | 22:54 | |
| *** mvk_ has joined #openstack-keystone | 22:58 | |
| *** rmizuno_ has quit IRC | 23:00 | |
| *** mvk has quit IRC | 23:01 | |
| *** rk4n has joined #openstack-keystone | 23:02 | |
| notmorgan | stevemar: must be :P or ... someone doesn't suck at vacation | 23:02 |
| *** dan_nguyen has quit IRC | 23:04 | |
| *** edtubill has quit IRC | 23:16 | |
| *** ayoung has joined #openstack-keystone | 23:17 | |
| *** ChanServ sets mode: +v ayoung | 23:17 | |
| notmorgan | stevemar: so.. why is a raven like a writing desk? | 23:17 |
| *** BjoernT has quit IRC | 23:24 | |
| *** dan_nguyen has joined #openstack-keystone | 23:25 | |
| *** adrian_otto has joined #openstack-keystone | 23:28 | |
| *** browne has quit IRC | 23:30 | |
| *** sdake has quit IRC | 23:32 | |
| *** sdake has joined #openstack-keystone | 23:33 | |
| *** browne has joined #openstack-keystone | 23:35 | |
| *** rderose has joined #openstack-keystone | 23:39 | |
| *** rcernin has quit IRC | 23:40 | |
| *** rk4n has quit IRC | 23:53 | |
| *** rk4n has joined #openstack-keystone | 23:56 | |
| *** ninag has joined #openstack-keystone | 23:58 | |
| *** ninag has quit IRC | 23:58 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!